CVE-2024-5628

The Fusion Builder plugin for WordPress contains a stored cross-site scripting flaw in its fusion_button shortcode affecting versions up to 3.11.9, stemming from inadequate sanitization and escaping of user-supplied shortcode attributes. Authenticated users with contributor permissions or higher can exploit this vulnerability to inject malicious scripts into pages that execute when other users view the affected content. A partial remediation was implemented in version 3.11.9, with complete fixes and additional protections deployed in 3.11.10.

Based on public CVE data (MITRE/NVD).